git.iko.soy/typeable/oauth2-proxy
on 71dc702 help sign in
typeable/oauth2-proxy/providers/gitlab_test.go
167 lines 4.3 kB history raw
1package providers
3import (
4 "context"
5 "net/http"
6 "net/http/httptest"
7 "net/url"
8 "testing"
10 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
11 "github.com/stretchr/testify/assert"
14func testGitLabProvider(hostname string) *GitLabProvider {
15 p := NewGitLabProvider(
16 &ProviderData{
17 ProviderName: "",
18 LoginURL: &url.URL{},
19 RedeemURL: &url.URL{},
20 ProfileURL: &url.URL{},
21 ValidateURL: &url.URL{},
22 Scope: ""})
23 if hostname != "" {
24 updateURL(p.Data().LoginURL, hostname)
25 updateURL(p.Data().RedeemURL, hostname)
26 updateURL(p.Data().ProfileURL, hostname)
27 updateURL(p.Data().ValidateURL, hostname)
28 }
30 return p
33func testGitLabBackend() *httptest.Server {
34 userInfo := `
35 {
36 "nickname": "FooBar",
37 "email": "foo@bar.com",
38 "email_verified": false,
39 "groups": ["foo", "bar"]
40 }
41 `
42 authHeader := "Bearer gitlab_access_token"
44 return httptest.NewServer(http.HandlerFunc(
45 func(w http.ResponseWriter, r *http.Request) {
46 if r.URL.Path == "/oauth/userinfo" {
47 if r.Header["Authorization"][0] == authHeader {
48 w.WriteHeader(200)
49 w.Write([]byte(userInfo))
50 } else {
51 w.WriteHeader(401)
52 }
53 } else {
54 w.WriteHeader(404)
55 }
56 }))
59func TestGitLabProviderBadToken(t *testing.T) {
60 b := testGitLabBackend()
61 defer b.Close()
63 bURL, _ := url.Parse(b.URL)
64 p := testGitLabProvider(bURL.Host)
66 session := &sessions.SessionState{AccessToken: "unexpected_gitlab_access_token"}
67 _, err := p.GetEmailAddress(context.Background(), session)
68 assert.NotEqual(t, nil, err)
71func TestGitLabProviderUnverifiedEmailDenied(t *testing.T) {
72 b := testGitLabBackend()
73 defer b.Close()
75 bURL, _ := url.Parse(b.URL)
76 p := testGitLabProvider(bURL.Host)
78 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
79 _, err := p.GetEmailAddress(context.Background(), session)
80 assert.NotEqual(t, nil, err)
83func TestGitLabProviderUnverifiedEmailAllowed(t *testing.T) {
84 b := testGitLabBackend()
85 defer b.Close()
87 bURL, _ := url.Parse(b.URL)
88 p := testGitLabProvider(bURL.Host)
89 p.AllowUnverifiedEmail = true
91 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
92 email, err := p.GetEmailAddress(context.Background(), session)
93 assert.Equal(t, nil, err)
94 assert.Equal(t, "foo@bar.com", email)
97func TestGitLabProviderUsername(t *testing.T) {
98 b := testGitLabBackend()
99 defer b.Close()
101 bURL, _ := url.Parse(b.URL)
102 p := testGitLabProvider(bURL.Host)
103 p.AllowUnverifiedEmail = true
105 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
106 username, err := p.GetUserName(context.Background(), session)
107 assert.Equal(t, nil, err)
108 assert.Equal(t, "FooBar", username)
111func TestGitLabProviderGroupMembershipValid(t *testing.T) {
112 b := testGitLabBackend()
113 defer b.Close()
115 bURL, _ := url.Parse(b.URL)
116 p := testGitLabProvider(bURL.Host)
117 p.AllowUnverifiedEmail = true
118 p.Groups = []string{"foo"}
120 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
121 email, err := p.GetEmailAddress(context.Background(), session)
122 assert.Equal(t, nil, err)
123 assert.Equal(t, "foo@bar.com", email)
126func TestGitLabProviderGroupMembershipMissing(t *testing.T) {
127 b := testGitLabBackend()
128 defer b.Close()
130 bURL, _ := url.Parse(b.URL)
131 p := testGitLabProvider(bURL.Host)
132 p.AllowUnverifiedEmail = true
133 p.Groups = []string{"baz"}
135 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
136 _, err := p.GetEmailAddress(context.Background(), session)
137 assert.NotEqual(t, nil, err)
140func TestGitLabProviderEmailDomainValid(t *testing.T) {
141 b := testGitLabBackend()
142 defer b.Close()
144 bURL, _ := url.Parse(b.URL)
145 p := testGitLabProvider(bURL.Host)
146 p.AllowUnverifiedEmail = true
147 p.EmailDomains = []string{"bar.com"}
149 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
150 email, err := p.GetEmailAddress(context.Background(), session)
151 assert.Equal(t, nil, err)
152 assert.Equal(t, "foo@bar.com", email)
155func TestGitLabProviderEmailDomainInvalid(t *testing.T) {
156 b := testGitLabBackend()
157 defer b.Close()
159 bURL, _ := url.Parse(b.URL)
160 p := testGitLabProvider(bURL.Host)
161 p.AllowUnverifiedEmail = true
162 p.EmailDomains = []string{"baz.com"}
164 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
165 _, err := p.GetEmailAddress(context.Background(), session)
166 assert.NotEqual(t, nil, err)